Threats tagged 'ghsa-jmxh-862m-3gxj'

Apache Kafka Connect has an authentication bypass vulnerability in the admin REST API when the admin.listeners property is configured separately from the main listeners. This misconfiguration causes security extensions not to apply to the admin listener endpoints, allowing unauthenticated access. An attacker with network access to the admin listener can read logger configurations and modify logger levels cluster-wide, potentially impacting availability and observability. The issue is fixed in Apache Kafka versions 4.2.2, 4.3.2, and 4.4.0. Users unable to upgrade immediately can mitigate by removing or leaving admin.listeners unset, causing admin resources to share the main listener and inherit its security extensions.